1.a does not implement Implicit flow (sending token #token=..) sending #_=_ is only protection of facebook open redirect, it's impossible to do same on every p

1.a does not implement Implicit flow (sending token #token=..) sending #_=_ is only protection of facebook open redirect, it's impossible to do same on every possible open redirector on the client's website. by static I mean exact value of path+query